SwaetRAT Malware: A Deeper Look Into Its Capabilities and Objectives

A Deceptive Threat with Remote Access Capabilities

SwaetRAT is a sophisticated Remote Access Trojan (RAT) that utilizes advanced evasion techniques to avoid detection while maintaining persistence on compromised systems. This .Net-based malware is capable of executing commands remotely, allowing attackers to manipulate infected devices for various nefarious purposes. By leveraging native Windows libraries and reflection mechanisms, it interacts with the operating system at a low level, enabling it to execute payloads and control system processes without raising immediate suspicion.

How SwaetRAT Gains a Foothold in Systems

To establish itself within a system, the malware takes advantage of API-level interactions. It employs live patching techniques to bypass security defenses, modifying functions that typically detect or log suspicious activity. One such modification involves patching AmsiScanBuffer(), which prevents security software from analyzing malicious scripts. Additionally, the malware alters EtwEventWrite(), a function responsible for generating event logs, ensuring that its activities remain undetected by logging mechanisms.

SwaetRAT further solidifies its position by tampering with the ntdll.dll library, modifying key functions to return predetermined values. This approach varies based on the system’s architecture, whether it is 32-bit or 64-bit, showcasing its adaptability. Once these modifications are in place, the malware proceeds to decode and execute a Base64-encoded payload that ultimately loads an assembly for further operations.

A Closer Look at Its Payload and Execution

The decoded payload is structured as a Portable Executable (PE) file, a standard format for Windows executables and dynamic-link libraries (DLLs). By creating an instance of its entry-point class and invoking its methods, SwaetRAT ensures that its malicious functionalities are properly executed. One of its key evasion tactics includes copying itself to the %LOCALAPPDATA%\Microsoft\_OneDrive.exe path. This behavior is designed to bypass sandbox environments that often analyze files from fixed directories.

To maintain persistence, SwaetRAT modifies the system’s registry and creates startup shortcuts. It writes its executable path to a registry key under the user’s Software hive, ensuring that the malicious process runs every time the system boots up. A corresponding shortcut in the Startup folder retrieves this path, executing a PowerShell command to relaunch the malware, effectively embedding itself within the system’s startup processes.

Communication and Command Execution

Once operational, the malware establishes a connection with a command-and-control (C2) server, allowing remote attackers to issue instructions. The decoded payload interacts with a web client, converting a hex-encoded string into a byte array before executing aspnet_compiler.exe with these decoded bytes as arguments. This execution flow suggests an effort to run further malicious code under the guise of legitimate system processes.

Identified Variants and Previous Observations

SwaetRAT has been linked to campaigns analyzed in 2023. The malware sample examined in that instance retained the same RAT functionalities and was associated with a C2 server located at 144.126.149.221:7777. A notable characteristic of this sample was its replication into the % APPDATA%CCleaner.exe directory, indicating its attempt to masquerade as a well-known software utility. Interestingly, the lack of obfuscation in this variant made it easier for analysts to extract its remote access capabilities and communication patterns.

The Implications of SwaetRAT’s Activities

The presence of SwaetRAT on a device can lead to significant security concerns. Given its remote access features, attackers could execute arbitrary commands, manipulate files, or deploy additional malicious payloads. Furthermore, its ability to evade detection and maintain persistence means that compromised systems may remain under attacker control for extended periods without users noticing any suspicious activity.

Understanding the tactics used by threats like SwaetRAT is crucial for everyone in implementing effective defenses. Regular security updates, monitoring for unusual system modifications, and employing robust endpoint protection measures can help mitigate the risks posed by such threats. By staying informed and vigilant, users can better protect their digital environments from stealthy intrusions like SwaetRAT.